About the fines, there’s a second option: make them more frequent, so there’s less chance on getting away with (minor) transgressions.

This would require well staffed regulatory bodies. At least for GDPR, I don’t think we have that.